Rule: Backup Recovery Points Should Not Expire Before Retention Period

Rule Description: Backup Recovery Points Expiry Should Not Occur Before Retention Period for CISA Cyber Essentials

Troubleshooting Steps:

2. 1.
   Check the configuration settings of the backup software or system used for CISA Cyber Essentials compliance.
4. 2.
   Review the defined retention period for backup recovery points.
6. 3.
   Verify the expiry date of the recovery points against the retention period.
8. 4.
   Check the backup software logs for any reported issues or errors related to recovery point expiration.

Necessary Codes:

$RetentionPeriod = 30 # Define the retention period in days
$RecoveryPoints = Get-BackupRecoveryPoints # Replace with appropriate cmdlet to retrieve recovery points

foreach ($RecoveryPoint in $RecoveryPoints) {
    $ExpiryDate = $RecoveryPoint.ExpiryDate
    $RetentionEndDate = (Get-Date).AddDays(-$RetentionPeriod)
    
    if ($ExpiryDate -lt $RetentionEndDate) {
        Remove-BackupRecoveryPoint -Id $RecoveryPoint.Id # Replace with appropriate cmdlet to remove recovery point
    }
}

Step-by-Step Guide for Remediation:

2. 1.
   Identify the backup software or system used for CISA Cyber Essentials compliance.
4. 2.
   Access the configuration settings or administrative console for the backup software.
6. 3.
   Locate the section or option related to backup retention or recovery point expiration.
8. 4.
   Review the currently defined retention period for the recovery points.
10. 5.
    Confirm that the retention period aligns with the required duration specified by CISA Cyber Essentials.
12. 6.
    If the retention period is set correctly, no further action is required. Otherwise, proceed to the next step.
14. 7.
    Adjust the retention period to match the requirements specified by CISA Cyber Essentials.
16. 8.
    Save the changes and ensure that they are applied to all relevant backup jobs or policies.
18. 9.
    Monitor the backup software or system to verify that the recovery points are retained for the defined period and do not expire prematurely.
20. 10.
    If any recovery points are found to expire before the retention period, consider reviewing the backup software logs for any reported issues or errors.
22. 11.
    If troubleshooting steps are executed, follow the appropriate actions to resolve the reported issues and ensure proper backup retention.
24. 12.
    Regularly review and validate the backup recovery points to ensure compliance with the defined retention period.